Recovering crashed encrypted Windows 7...

[Cr00zng]

I'd need some help with this...

I have a laptop where the SSD drive is encrypted by a commercial full disk encryption, or FDE, software. I've created a Win7 image backup just last weekend and promptly the system broke today; I've got a BSOD and and Windows no longer loads.

Interestingly, the FDE software's Power On Authentication, or POA, is still fully functional. I can start up the system, authenticate by my account/password, and it states that the solution is loading Windows. That's where Windows gives the error message about the "boot\bcd" cannot be located. I know as much that a restoring the boot record with the recovery CD would resolve this problem and the chances are that the system would boot normally and/or complaining about not being shut down properly, etc.

The kicker is that since the drive is encrypted via 256-bit AES encryption, the recovery CD cannot read the drive, or find Windows installation.

My question is, if I perform a restore of the image, will it restore the files to the same place where they have been? In another word, where does the restoration start and do I need to format the drive first? I'd rather not and see if it would restore the system to the same place where it's been.

The restored system probably will not be encrypted, but the installed software may start the encryption process after the first boot. Alternatively, I could just re-encrypt it manually.

No, I have not done a system restore with the recovery disk, but I did read the process and it seems straight forward.

TIA...

 

[Cr00zng]

Well, I've learned couple of obvious things during this process:

1. Don't use 64-bit rescue disc with a 32-bit image, it won't work
2. Make sure that the backup image is named "WindowsImageBackup" in the root of the backup drive

Rookie mistakes for the first time restoring an image...

The first restore without reformatting the drive had been successful and didn't get rid of the FDE software totally. Upon first reboot, it resulted in this error message:

SMG:Invalid image
System halted

Restoring the image at the second time with formatting the drive did get rid of the eror message at boot time and booted the system; however, it resulted in an other issue. The system shut down on its own at the logon screen, after about 30 seconds and/or a minute. Starting up in safe mode didn't have this issue and worked just fine.

Uninstalling the encryption software didn't run in safe mode; the chances are the reason was that the drive was not encrypted. The uninstall routine suppose to decrypt the drive prior to removing the software.

I opened up regedit and manually removed all references to the encryption software that I could find, about a dozen or so folders in different hives. The rest was cleaned up with Ccleaner after the installation folder has been deleted. Rebooted the laptop in normal mode and it works just fine now.

There are still lot of DLL files left over in the System32 and possibly other folders as well. Is there an easy way to clean up these files? Well, other than reinstalling Windows that is...
TIA...